cloud-init: replace password parameter in log messages

Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 0174feb32d7fd99f76fa6d21bcc34d62df04a084..b1c689697b090b7d1f53f83b6c9d97415961a197 100644 (file)
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -920,10 +920,16 @@ my $update_vm_api  = sub {
 
     my $background_delay = extract_param($param, 'background_delay');
 
+    if (defined(my $cipassword = $param->{cipassword})) {
+       # Same logic as in cloud-init (but with the regex fixed...)
+       $param->{cipassword} = PVE::Tools::encrypt_pw($cipassword)
+           if $cipassword !~ /^\$(?:[156]|2[ay])(\$.+){2}/;
+    }
 
     my @paramarr = (); # used for log message
     foreach my $key (sort keys %$param) {
-       push @paramarr, "-$key", $param->{$key};
+       my $value = $key eq 'cipassword' ? '<hidden>' : $param->{$key};
+       push @paramarr, "-$key", $value;
     }
 
     my $skiplock = extract_param($param, 'skiplock');
@@ -941,12 +947,6 @@ my $update_vm_api  = sub {
        PVE::Tools::validate_ssh_public_keys($ssh_keys);
     }
 
-    if (defined(my $cipassword = $param->{cipassword})) {
-       # Same logic as in cloud-init (but with the regex fixed...)
-       $param->{cipassword} = PVE::Tools::encrypt_pw($cipassword)
-           if $cipassword !~ /^\$(?:[156]|2[ay])(\$.+){2}/;
-    }
-
     die "no options specified\n" if !$delete_str && !$revert_str && !scalar(keys %$param);
 
     my $storecfg = PVE::Storage::config();